aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorAntonino A. Daplas <adaplas@gmail.com>2007-05-31 02:04:57 -0400
committerLinus Torvalds <torvalds@woody.linux-foundation.org>2007-05-31 10:48:27 -0400
commita2b7d2e97edcad0e95ae0d3c253d3f2f69254fa4 (patch)
tree26b392f8aa430a2715f40f54290952ea1e070436
parent3f0a6766e0cc5a577805732e5adb50a585c58175 (diff)
neofb: Fix pseudo_palette array overrun in neofb_setcolreg
The pseudo_palette has room for 16 entries only, but in truecolor mode, it attempts to write 256. Signed-off-by: Antonino Daplas <adaplas@gmail.com> Acked-by: Tero Roponen <teanropo@jyu.fi> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
-rw-r--r--drivers/video/neofb.c30
1 files changed, 16 insertions, 14 deletions
diff --git a/drivers/video/neofb.c b/drivers/video/neofb.c
index bd30aba242d..731d7a5c5aa 100644
--- a/drivers/video/neofb.c
+++ b/drivers/video/neofb.c
@@ -1286,34 +1286,36 @@ static int neofb_setcolreg(u_int regno, u_int red, u_int green, u_int blue,
1286 if (regno >= fb->cmap.len || regno > 255) 1286 if (regno >= fb->cmap.len || regno > 255)
1287 return -EINVAL; 1287 return -EINVAL;
1288 1288
1289 switch (fb->var.bits_per_pixel) { 1289 if (fb->var.bits_per_pixel <= 8) {
1290 case 8:
1291 outb(regno, 0x3c8); 1290 outb(regno, 0x3c8);
1292 1291
1293 outb(red >> 10, 0x3c9); 1292 outb(red >> 10, 0x3c9);
1294 outb(green >> 10, 0x3c9); 1293 outb(green >> 10, 0x3c9);
1295 outb(blue >> 10, 0x3c9); 1294 outb(blue >> 10, 0x3c9);
1296 break; 1295 } else if (regno < 16) {
1297 case 16: 1296 switch (fb->var.bits_per_pixel) {
1298 ((u32 *) fb->pseudo_palette)[regno] = 1297 case 16:
1298 ((u32 *) fb->pseudo_palette)[regno] =
1299 ((red & 0xf800)) | ((green & 0xfc00) >> 5) | 1299 ((red & 0xf800)) | ((green & 0xfc00) >> 5) |
1300 ((blue & 0xf800) >> 11); 1300 ((blue & 0xf800) >> 11);
1301 break; 1301 break;
1302 case 24: 1302 case 24:
1303 ((u32 *) fb->pseudo_palette)[regno] = 1303 ((u32 *) fb->pseudo_palette)[regno] =
1304 ((red & 0xff00) << 8) | ((green & 0xff00)) | 1304 ((red & 0xff00) << 8) | ((green & 0xff00)) |
1305 ((blue & 0xff00) >> 8); 1305 ((blue & 0xff00) >> 8);
1306 break; 1306 break;
1307#ifdef NO_32BIT_SUPPORT_YET 1307#ifdef NO_32BIT_SUPPORT_YET
1308 case 32: 1308 case 32:
1309 ((u32 *) fb->pseudo_palette)[regno] = 1309 ((u32 *) fb->pseudo_palette)[regno] =
1310 ((transp & 0xff00) << 16) | ((red & 0xff00) << 8) | 1310 ((transp & 0xff00) << 16) | ((red & 0xff00) << 8) |
1311 ((green & 0xff00)) | ((blue & 0xff00) >> 8); 1311 ((green & 0xff00)) | ((blue & 0xff00) >> 8);
1312 break; 1312 break;
1313#endif 1313#endif
1314 default: 1314 default:
1315 return 1; 1315 return 1;
1316 }
1316 } 1317 }
1318
1317 return 0; 1319 return 0;
1318} 1320}
1319 1321